ASA Extended Access-List with Object Group

faiqmahdi — Tue, 12 Mar 2019 07:11:12 GMT

Just for the curiosity, how we can create an extended access-list with Object Group with my example:

show object-group

object-group network SSL
network-object 10.30.40.0 255.255.255.0
network-object 10.30.58.31 255.255.255.255

My-FW(config)# access-list SPLIT_TUNNEL extended permit object-group ?

configure mode commands/options:
WORD Service or protocol object-group name

My-FW(config)# access-list SPLIT_TUNNEL permit object-group SSL
ERROR: Invalid object-group type

Currently I am using with Standard Access-List but I want to move on Extended Access Lists with Object Group:

access-list SPLIT_TUNNEL standard permit 10.30.40.0 255.255.255.0
access-list SPLIT_TUNNEL standard permit host 10.30.58.31

Thanks.

Hi,

Shivapramod M — Mon, 25 Jan 2016 05:43:38 GMT

Hi,

You should be able to create the access list. But you need to mention the protocol before the object group.

access-list SPLIT_TUNNEL extended permit ip object-group SSL any

Thanks,
Shivapramod M
Please remember to select a correct answer and rate helpful posts

faiqmahdi — Mon, 25 Jan 2016 09:57:12 GMT

Thanks it worked.